nik/FreedomBox
1
0
Fork 0
mirror of https://github.com/freedombox/FreedomBox.git synced 2026-06-03 10:50:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use os.path.join() instead of string concatenation in actions

Browse Source 
Presence of / in action is not a problem at is check for early. Any other tricks
are secured against by the realpath() check immediately afterwards.
This commit is contained in:
Sunil Mohan Adapa 2014-08-17 19:40:58 +05:30
parent 642a4e10ff
commit 4387c28495
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
actions.py
View File

@ -113,7 +113,7 @@ def _run(action, options=None, async=False, run_as_root=False):
if os.sep in action:
raise ValueError("Action can't contain:" + os.sep)
cmd = cfg.actions_dir + os.sep + action
cmd = os.path.join(cfg.actions_dir, action)
if not os.path.realpath(cmd).startswith(cfg.actions_dir):
raise ValueError("Action has to be in directory %s" % cfg.actions_dir)